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DETAILED ACTION 

1 . This action is in response to the original filing of April 19 th , 2004. Claims 1-26 are 
pending and have been considered below. 

Specification 

2. The disclosure is objected to because of the following informalities: the examiner notes 
that on page 7, line 6 of the specification, "Random Access Memory (RAM)", is not referred to 
as object 104 as shown in figure 1 of the drawings. 

Appropriate correction is required. 

Claim Objections 

3. Claims 10, 15 and 24-26 are objected to because of the following informalities: the 
examiner notes the use of the acronym "HTTP" without first including a description in plain text, 
as required. Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

i 

Claims 16-23 and 26 are rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non-statutory subject matter. Claims 16-23 and 26 are drawn to a computer storage medium, 
which the applicant has defined in the specification (page 7, lines 1-4) to encompass an 
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electronic transmission signal. The Office considers an electronic signal to be a form of energy. 
Energy is not a series of steps or acts and this is not a process. Energy is not a physical article or 
object and as such is not a machine or manufacture. Energy is not a combination of substances 
and therefore not a compilation of matter. Thus, an electronic transmission signal does not fall 
within any of the four categories of invention. Therefore, Claims 16-23 arid 26 are not statutory. 

Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

6. Claims 1-5, 9, 1 1 and 16-20 rejected under 35 U.S.C. 102(b) as being anticipated by Jiet 
ah (5,623,600). 

Claims 1 and 16: Ji et al. discloses a method and computer storage medium containing code for 
maintaining computer security comprising: 

a. providing a signature file [column 7, lines 51-65]. The examiner notes that it is 
inherent to provide a signature file when performing a signature scanning virus detection 
method; 

b. receiving an incoming message from at least one client Q,om\*x\ter(downloaded from 
the web) [column 5, lines 28-38]; 
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c. comparing the received incoming message with the signature file to determine whether 
the incoming message is malicious(performs a version of signature scanning virus detection) 
[column 7, lines 51-65]; 

d. and blocking^ not transfer file) the incoming messages determined to be malicious 
from reaching a web server [column 8, lines 4-16]. 

Claims 2-4 and 17-19: Ji et al. discloses a method and computer storage medium as in claims 1 
and 16 above and further discloses that the comparing further comprises: 

a. parsing the incoming message(scanning the message body) [column 10, lines 26-28]. 
The examiner notes that scanning the message body implies parsing the message into at least a 
message header and message body; 

b. converting the incoming message into an internal formdX(decoding encoded portions) 
[column 10, lines 57-67]; 

c. comparing the converted incoming message with the signature file and determining 
whether the converted incoming message is malicious based on the comparison(fececwtes a virus- 
checking program) [column 11, lines 1-2]; 

d. reassembling the converted incoming message back into its original format prior to 
forwzrdmg(transmits the message) it to the web server if it is determined that the code is not 
maliciousfao viruses are detected) and forwarding(?ra«.smzte the message) the reassembled 
message to the web server [column 10, lines 42-56 and column 11, lines 4-6]. 

Claims 5 and 20: Ji et al. discloses a method as in claims 1 and 16 above and further discloses 
that the signature file contains information about known system vulnerabilities [column 7, lines 
51-65]. The examiner notes that it is inherent for the signature file to contain information about 
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vulnerabilities in order for the virus detection program to know what kind of vulnerabilities it is 
scanning for. 

Claim 9: Ji et al. discloses a system for maintaining computer security comprising: 

a. a signature file [column 7, lines 51-65]. The examiner notes that it is inherent to 
provide a signature file when performing a signature scanning virus detection method; 

b. a web server(gateway node) [column 3, lines 52-63] ; 

c. and a proxy machinefcraxy server) receiving an incoming message from at least one 
client computer, comparing the received incoming message with the signature file to determine 
whether t he incoming message is malicious and blocking incoming messages determined to be 
malicious from reaching the web server [column 4, lines 56-67]. 

Claim 11: Ji et al. discloses a system as in claim 9 above and further discloses that the signature 
file contains information about known system vulnerabilities [column 7, lines 51-65]. The 
examiner notes that it is inherent for the signature file to contain information about 
vulnerabilities in order for the virus detection program to know what kind of vulnerabilities it is 
scanning for. 

Claim Rejections - 35 USC § 103 
7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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8. Claims 6-8, 12-14 and 21-23 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Ji et al. (5,623,600) in view of Cambridge (7,080,000). 

Claims 6, 12 and 21: Ji et al. discloses a method, system and computer storage medium as in 
claims 1, 9 and 16 above, but does not explicitly disclose that the signature file is made available 
through a web server. However, Cambridge discloses a similar method, system and computer 
storage medium and further discloses that the signature file(antivirus database) is made available 
through a web SQWtr(antivirus server) [abstract]. Therefore, it would have been obvious to one 
of ordinary skill in the art at the time of invention to make the signature files available through a 
web server. One would have been motivated to do so in order to make signature file updates 
easily accessible. 

Claims 7, 13 and 22: Ji et al. discloses a method, system and computer storage medium as in 
claims 1 , 9 and 16 above, but does not explicitly disclose continuously updating the signature 
file. However, Cambridge discloses a similar method, system and computer storage medium and 
further discloses continuously updating the signature ^(antivirus data file) [column 2, lines 63- 
67]. Therefore, it would have been obvious to one of ordinary skill in the art at the time of 
invention to continuously update the signature file. One would have been motivated to do so in 
order to be able to detect the latest viruses, which are constantly being created. 
Claims 8, 14 and 23: Ji et al. discloses a method, system and computer storage medium as in 
claims 1, 9 and 16 above, but does not explicitly disclose periodically downloading the signature 
file in order to make its copy current. However, Cambridge discloses a similar method, system 
and computer storage medium and further discloses periodically downloading the signature 
&les(receiving a new antivirus file at one of the user computers) in order to make its copy current 
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[abstract]. Therefore, it would have been obvious to one of ordinary skill in the art at the time of 
invention to periodically download the signature files. One would have been motivated to do so 
in order to be able to detect the latest viruses, which are constantly being created. 

9. Claims 10, 15 and 24-26 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
JietaL (5,623,600). 

Claim 10: Ji et al. discloses a system as in claim 9 above and further discloses that the proxy 
machine further comprises: 

a. a message parser module for receiving, \)&Tsmg(scanning the message body) and 
con\Qr\mg(decoding encoded portions) the incoming messages into a defined format [column 

10, lines 26-28 and column 10, lines 57-67]. The examiner notes that scanning the message 
body implies parsing the message into at least a message header and message body. 

b. a message analyzer module for comparing the converted incoming messages with the 
signature ^(executes a virus-checking program) [column 11, lines 1-2]; 

c. and a message reassembly module for reassembling the converted incoming messages 
determined not to be maliciousfno viruses are detected) into their original format and forwarding 
them to the web server(transmits the message) [column 10, lines 42-56 and column 11, lines 4- 
6]. 

However, Ji et al. does not explicitly disclose that the message parser, analyzer and reassembly 
modules are HTTP message parser, analyzer and reassembly modules. Nonetheless, it would 
have been obvious to one of ordinary skill in the art at the time of invention to employ an HTTP 
message parser, analyzer and reassembly modules. One would have been motivated to do so in 
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order to capable of processing HTTP messages instead of other forms of electronic messages, 
depending on the intended application of the system. 

Claim J 5: Ji et al. discloses a system as in claim 10 above and further discloses that the 
signature file is linked to the HTTP message analyzer mod\x\e(executes a virus-checking 
program) [column 11, lines 1-2]. The examiner notes that it is inherent for the HTTP message 
analyzer to be linked to the signature file if it is using the signature file to scan for viruses. 
Claims 24-26: Ji et al. disclose a method, system and computer storage medium as in claims 1, 9 
and 16 above, but does not explicitly disclose that the incoming message comprises an HTTP 
messages. However, it would have been obvious to one of ordinary skill in the art at the time of 
invention for the incoming messages to be comprised of HTTP messages. One would have been 
motivated to do so in order to be capable of processing HTTP messages instead of other forms of 
electronic messages, depending on the intended application of the system. 

Conclusion 

10. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Hypponen et al. (6,577,920), Schnurer et al. (5,842,002) and Gluck et al. 
(5,948,104). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Edward Zee whose telephone number is (571) 270-1686. The 
examiner can normally be reached on Monday through Thursday 6:30AM-5 :00PM EST. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James W. Myhre can be reached on (571) 270-1065. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



EZ 

April 12, 2007 




